Skip to content

enable-http2

Default Severity: low

Explanation

Use the latest version of HTTP to ensure you are benefiting from security fixes

Possible Impact

Outdated versions of HTTP has security vulnerabilities

Suggested Resolution

Use the latest version of HTTP

Insecure Example

The following example will fail the azure-appservice-enable-http2 check. 

 resource "azurerm_app_service" "bad_example" {
   name                = "example-app-service"
   location            = azurerm_resource_group.example.location
   resource_group_name = azurerm_resource_group.example.name
   app_service_plan_id = azurerm_app_service_plan.example.id
 }

Secure Example

The following example will pass the azure-appservice-enable-http2 check. 

 resource "azurerm_app_service" "good_example" {
   name                = "example-app-service"
   location            = azurerm_resource_group.example.location
   resource_group_name = azurerm_resource_group.example.name
   app_service_plan_id = azurerm_app_service_plan.example.id

   site_config {
      http2_enabled = true
   }
 }